@sellable/mcp 0.1.770-wip.145.20260727141913 → 0.1.770

package/dist/agent-integration-request-context.d.ts

@@ -38,6 +38,16 @@
  */
 export declare const AGENT_INTEGRATION_CONTEXT_TOOL_NAMES: readonly ["integrations_list_tools", "integrations_describe_tool", "integrations_call_tool"];
 export type AgentIntegrationContextToolName = (typeof AGENT_INTEGRATION_CONTEXT_TOOL_NAMES)[number];
+/**
+ * Plan 142-05's connect trio, in a SECOND frozen set rather than appended to the
+ * one above: two suites pin `AGENT_INTEGRATION_CONTEXT_TOOL_NAMES` to exactly
+ * the three `integrations_*` names 141-06 registers, and those pins are correct
+ * — they guard 141's registration, not 142's. `isAgentIntegrationContextTool`
+ * spans both sets, so the fail-closed dispatch guard in `server.ts` covers the
+ * connect tools with no change to the switch-side plumbing.
+ */
+export declare const AGENT_INTEGRATION_CONNECT_TOOL_NAMES: readonly ["search_available_integrations", "start_integration_connection", "get_integration_connection_status"];
+export type AgentIntegrationConnectToolName = (typeof AGENT_INTEGRATION_CONNECT_TOOL_NAMES)[number];
 /** The trusted actor triple a managed-integration call forwards to the backend. */
 export type AgentIntegrationRequestContext = {
     requesterId: string;

package/dist/agent-integration-request-context.js

@@ -41,9 +41,23 @@ export const AGENT_INTEGRATION_CONTEXT_TOOL_NAMES = Object.freeze([
     "integrations_describe_tool",
     "integrations_call_tool",
 ]);
+/**
+ * Plan 142-05's connect trio, in a SECOND frozen set rather than appended to the
+ * one above: two suites pin `AGENT_INTEGRATION_CONTEXT_TOOL_NAMES` to exactly
+ * the three `integrations_*` names 141-06 registers, and those pins are correct
+ * — they guard 141's registration, not 142's. `isAgentIntegrationContextTool`
+ * spans both sets, so the fail-closed dispatch guard in `server.ts` covers the
+ * connect tools with no change to the switch-side plumbing.
+ */
+export const AGENT_INTEGRATION_CONNECT_TOOL_NAMES = Object.freeze([
+    "search_available_integrations",
+    "start_integration_connection",
+    "get_integration_connection_status",
+]);
 export const AGENT_INTEGRATION_CONTEXT_REQUIRED_ERROR = "agent_request_context_required";
 export function isAgentIntegrationContextTool(name) {
-    return AGENT_INTEGRATION_CONTEXT_TOOL_NAMES.includes(name);
+    return (AGENT_INTEGRATION_CONTEXT_TOOL_NAMES.includes(name) ||
+        AGENT_INTEGRATION_CONNECT_TOOL_NAMES.includes(name));
 }
 /**
  * Resolves the trusted actor for a managed-integration tool call.

package/dist/agent-scope.d.ts

@@ -0,0 +1,17 @@
+export type SellableAgentScope = "WORKSPACE" | "CROSS_WORKSPACE";
+/**
+ * Returns the last server-reported affordance scope. An unknown scope fails
+ * closed to WORKSPACE; authorization still belongs to the API middleware.
+ */
+export declare function getAgentScope(): SellableAgentScope;
+export declare function hasRecordedAgentScope(): boolean;
+export declare function recordAgentScope(value: unknown): SellableAgentScope;
+/**
+ * Coalesces the one lazy membership read needed by a fresh Agent session.
+ * The loader returns the same response body that carries `agentScope`.
+ */
+export declare function ensureAgentScope(loader: () => Promise<{
+    agentScope?: unknown;
+}>): Promise<SellableAgentScope>;
+/** Test-only reset; production keeps one server-reported scope per process. */
+export declare function resetAgentScopeForTests(): void;

package/dist/agent-scope.js

@@ -0,0 +1,40 @@
+let reportedAgentScope = null;
+let pendingScopeLoad = null;
+function parseAgentScope(value) {
+    return value === "WORKSPACE" || value === "CROSS_WORKSPACE" ? value : null;
+}
+/**
+ * Returns the last server-reported affordance scope. An unknown scope fails
+ * closed to WORKSPACE; authorization still belongs to the API middleware.
+ */
+export function getAgentScope() {
+    return reportedAgentScope ?? "WORKSPACE";
+}
+export function hasRecordedAgentScope() {
+    return reportedAgentScope !== null;
+}
+export function recordAgentScope(value) {
+    reportedAgentScope = parseAgentScope(value) ?? "WORKSPACE";
+    return reportedAgentScope;
+}
+/**
+ * Coalesces the one lazy membership read needed by a fresh Agent session.
+ * The loader returns the same response body that carries `agentScope`.
+ */
+export async function ensureAgentScope(loader) {
+    if (reportedAgentScope)
+        return reportedAgentScope;
+    if (!pendingScopeLoad) {
+        pendingScopeLoad = loader()
+            .then((response) => recordAgentScope(response.agentScope))
+            .finally(() => {
+            pendingScopeLoad = null;
+        });
+    }
+    return pendingScopeLoad;
+}
+/** Test-only reset; production keeps one server-reported scope per process. */
+export function resetAgentScopeForTests() {
+    reportedAgentScope = null;
+    pendingScopeLoad = null;
+}

package/dist/agent-tool-names.d.ts

@@ -3,4 +3,22 @@
  * manifests. Keep this free of tool implementation imports so Next can bundle
  * it; registry parity is enforced in sellable-agent-tool-policy.test.ts.
  */
-export declare const SELLABLE_MCP_TOOL_NAMES: readonly ["add_column", "add_on_demand_leads", "add_rubric_item", "add_teammate", "add_to_comment_campaign", "add_to_connection_campaign", "add_to_inmail_campaign", "archive_campaign", "attach_recommended_sequence", "attach_sequence", "bootstrap_create_campaign", "bootstrap_engage", "bootstrap_engage_multi", "bootstrap_find_leads", "bulk_enrich_with_prospeo", "calculate_linkedin_hook_preview", "cancel_campaign_message_preparation", "cancel_find_leads", "cancel_lead_import", "capture_post_idea", "check_inbox_reply_eligibility", "check_rubric", "commit_blueprint", "complete_sender_research", "confirm_harvest_job_companies", "confirm_lead_list", "confirm_prospeo_company_accounts", "copy_sender_config", "create_campaign", "create_on_demand_campaign", "create_on_demand_table", "create_workflow_table", "create_workspace", "delete_column", "delete_rubric_item", "draft_rubrics", "duplicate_campaign", "enrich_with_prospeo", "export_table_csv", "export_workspace_csv", "fetch_company", "fetch_company_posts", "fetch_linkedin_posts", "fetch_linkedin_profile", "fetch_post_engagers", "fill_campaign_horizon", "get_active_workspace", "get_auth_status", "get_campaign", "get_campaign_context", "get_campaign_framework", "get_campaign_message_preparation_status", "get_campaign_messages_preview", "get_campaign_navigation_state", "get_campaign_refill_state", "get_campaign_table_schema", "get_campaign_waterfall", "get_campaigns", "get_column_schema", "get_company_info", "get_engage_memory", "get_engage_state", "get_engaged_posts", "get_find_leads_run", "get_inbox_thread", "get_linkedin_profile", "get_or_create_direct_campaign_table", "get_post_draft", "get_post_find_leads_scout_registry", "get_post_idea", "get_prospeo_credits", "get_provider_prompt", "get_published_post", "get_refill_plan_v2", "get_refill_target_plan", "get_rows", "get_rows_minimal", "get_runtime_identity", "get_scheduler_fill_capacity", "get_sender", "get_sender_routing", "get_source_scout_registry", "get_subskill_asset", "get_subskill_prompt", "get_table_rows", "get_user_posts", "get_workspace", "import_leads", "init_on_demand_sequence", "integrations_call_tool", "integrations_describe_tool", "integrations_list_tools", "list_column_types", "list_dnc_entries", "list_post_draft_iterations", "list_post_drafts", "list_post_ideas", "list_published_posts", "list_senders", "list_subskill_prompts", "list_tables", "list_workspaces", "load_csv_dnc_entries", "load_csv_domains", "load_csv_linkedin_leads", "lookup_sales_nav_filter", "mark_post_published", "migrate_flat_configs", "pause_campaign", "pause_direct_campaign", "pause_on_demand_campaign", "preflight_find_leads_provider", "prepare_campaign_ab_test", "queue_campaign_cells", "queue_cells", "record_campaign_review_batch", "record_engage_proven_search", "refill_sends", "refill_sends_v2", "refill_v3_sender_date_eligibility", "refill_v3_workspace_inventory", "refresh_paid_inmail_credits", "refresh_sender_engagement", "reissue_find_leads_watch_link", "render_linkedin_post_preview", "reorder_columns", "resolve_campaign_fill_route", "revise_message_template_and_rerun", "run_scheduler_sweep", "save_domain_filters", "save_hook_research", "save_post_draft", "save_rubrics", "search_apollo", "search_engagement_posts", "search_harvest_jobs", "search_inbox_threads", "search_prospeo", "search_prospeo_companies", "search_sales_nav", "search_signals", "search_subskill_prompts", "select_campaign_cells", "select_necessary_rubrics", "select_promising_posts", "send_inbox_draft", "send_inbox_manual_reply", "set_active_workspace", "set_campaign_waterfall_order", "set_company_info", "set_engage_state", "set_engage_style_guide", "set_headline_icp_criteria", "set_sender_calendar_link", "set_sender_routing", "setup_evergreen_campaigns", "start_campaign", "start_campaign_message_preparation", "start_cli_login", "start_direct_campaign", "start_on_demand_campaign", "update_campaign", "update_campaign_brief", "update_cell", "update_column", "update_find_leads_run", "update_inbox_draft", "update_post_draft", "update_published_post_metrics", "update_rubric_item", "upsert_engage_tracked_person", "upsert_rubric", "validate_campaign1_kickoff_handoff", "verify_table_row", "wait_for_campaign_processing", "wait_for_campaign_table_ready", "wait_for_cli_login", "wait_for_find_leads_run", "wait_for_lead_list_ready", "wait_for_rubric_results"];
+export declare const SELLABLE_MCP_TOOL_NAMES: readonly ["add_column", "add_on_demand_leads", "add_rubric_item", "add_teammate", "add_to_comment_campaign", "add_to_connection_campaign", "add_to_inmail_campaign", "archive_campaign", "attach_recommended_sequence", "attach_sequence", "bootstrap_create_campaign", "bootstrap_engage", "bootstrap_engage_multi", "bootstrap_find_leads", "bulk_enrich_with_prospeo", "calculate_linkedin_hook_preview", "cancel_campaign_message_preparation", "cancel_find_leads", "cancel_lead_import", "capture_post_idea", "check_inbox_reply_eligibility", "check_rubric", "commit_blueprint", "complete_sender_research", "confirm_harvest_job_companies", "confirm_lead_list", "confirm_prospeo_company_accounts", "copy_sender_config", "create_campaign", "create_on_demand_campaign", "create_on_demand_table", "create_workflow_table", "create_workspace", "delete_column", "delete_rubric_item", "draft_rubrics", "duplicate_campaign", "enrich_with_prospeo", "export_table_csv", "export_workspace_csv", "fetch_company", "fetch_company_posts", "fetch_linkedin_posts", "fetch_linkedin_profile", "fetch_post_engagers", "fill_campaign_horizon", "get_active_workspace", "get_auth_status", "get_campaign", "get_campaign_context", "get_campaign_framework", "get_campaign_message_preparation_status", "get_campaign_messages_preview", "get_campaign_navigation_state", "get_campaign_refill_state", "get_campaign_table_schema", "get_campaign_waterfall", "get_campaigns", "get_column_schema", "get_company_info", "get_engage_memory", "get_engage_state", "get_engaged_posts", "get_find_leads_run", "get_inbox_thread", "get_integration_connection_status", "get_linkedin_profile", "get_or_create_direct_campaign_table", "get_post_draft", "get_post_find_leads_scout_registry", "get_post_idea", "get_prospeo_credits", "get_provider_prompt", "get_published_post", "get_refill_target_plan", "get_rows", "get_rows_minimal", "get_runtime_identity", "get_scheduler_fill_capacity", "get_sender", "get_sender_routing", "get_source_scout_registry", "get_subskill_asset", "get_subskill_prompt", "get_table_rows", "get_user_posts", "get_workspace", "import_leads", "init_on_demand_sequence", "integrations_call_tool", "integrations_describe_tool", "integrations_list_tools", "list_column_types", "list_dnc_entries", "list_post_draft_iterations", "list_post_drafts", "list_post_ideas", "list_published_posts", "list_senders", "list_subskill_prompts", "list_tables", "list_workspaces", "load_csv_dnc_entries", "load_csv_domains", "load_csv_linkedin_leads", "lookup_sales_nav_filter", "mark_post_published", "migrate_flat_configs", "pause_campaign", "pause_direct_campaign", "pause_on_demand_campaign", "preflight_find_leads_provider", "prepare_campaign_ab_test", "queue_campaign_cells", "queue_cells", "record_campaign_review_batch", "record_engage_proven_search", "refill_sends", "refresh_paid_inmail_credits", "refresh_sender_engagement", "reissue_find_leads_watch_link", "render_linkedin_post_preview", "reorder_columns", "resolve_campaign_fill_route", "revise_message_template_and_rerun", "run_scheduler_sweep", "save_domain_filters", "save_hook_research", "save_post_draft", "save_rubrics", "search_apollo", "search_available_integrations", "search_engagement_posts", "search_harvest_jobs", "search_inbox_threads", "search_prospeo", "search_prospeo_companies", "search_sales_nav", "search_signals", "search_subskill_prompts", "select_campaign_cells", "select_necessary_rubrics", "select_promising_posts", "send_inbox_draft", "send_inbox_manual_reply", "set_active_workspace", "set_campaign_waterfall_order", "set_company_info", "set_engage_state", "set_engage_style_guide", "set_headline_icp_criteria", "set_sender_calendar_link", "set_sender_routing", "setup_evergreen_campaigns", "start_campaign", "start_campaign_message_preparation", "start_cli_login", "start_direct_campaign", "start_integration_connection", "start_on_demand_campaign", "update_campaign", "update_campaign_brief", "update_cell", "update_column", "update_find_leads_run", "update_inbox_draft", "update_post_draft", "update_published_post_metrics", "update_rubric_item", "upsert_engage_tracked_person", "upsert_rubric", "validate_campaign1_kickoff_handoff", "verify_table_row", "wait_for_campaign_processing", "wait_for_campaign_table_ready", "wait_for_cli_login", "wait_for_find_leads_run", "wait_for_lead_list_ready", "wait_for_rubric_results"];
+/**
+ * Explicit mutation classification lives beside (but outside) the flat tool
+ * registry. Neither this list nor `isMutatingTool` is an input to
+ * `compileAgentToolPolicy`, so editing it cannot move the fleet-pinned
+ * `policyHash`.
+ */
+export declare const MUTATING_TOOL_NAMES: readonly ["pause_campaign", "archive_campaign", "update_campaign", "fill_campaign_horizon", "set_campaign_waterfall_order", "set_sender_routing", "send_inbox_draft", "send_inbox_manual_reply", "load_csv_dnc_entries", "update_cell", "queue_cells"];
+export declare function isMutatingTool(name: string): boolean;
+export declare const CROSS_WORKSPACE_EXPLICIT_WORKSPACE_REQUIRED: {
+    readonly code: "cross_workspace_explicit_workspace_required";
+    readonly message: "Cross-workspace mutations require an explicit non-empty workspaceId. Name the target workspace and retry.";
+};
+export declare function crossWorkspaceMutationRefusal(input: {
+    scope: "WORKSPACE" | "CROSS_WORKSPACE";
+    toolName: string;
+    workspaceBinding: string | undefined;
+    args: unknown;
+}): typeof CROSS_WORKSPACE_EXPLICIT_WORKSPACE_REQUIRED | null;

package/dist/agent-tool-names.js

@@ -69,6 +69,7 @@ export const SELLABLE_MCP_TOOL_NAMES = [
     "get_engaged_posts",
     "get_find_leads_run",
     "get_inbox_thread",
+    "get_integration_connection_status",
     "get_linkedin_profile",
     "get_or_create_direct_campaign_table",
     "get_post_draft",
@@ -77,7 +78,6 @@ export const SELLABLE_MCP_TOOL_NAMES = [
     "get_prospeo_credits",
     "get_provider_prompt",
     "get_published_post",
-    "get_refill_plan_v2",
     "get_refill_target_plan",
     "get_rows",
     "get_rows_minimal",
@@ -122,9 +122,6 @@ export const SELLABLE_MCP_TOOL_NAMES = [
     "record_campaign_review_batch",
     "record_engage_proven_search",
     "refill_sends",
-    "refill_sends_v2",
-    "refill_v3_sender_date_eligibility",
-    "refill_v3_workspace_inventory",
     "refresh_paid_inmail_credits",
     "refresh_sender_engagement",
     "reissue_find_leads_watch_link",
@@ -138,6 +135,7 @@ export const SELLABLE_MCP_TOOL_NAMES = [
     "save_post_draft",
     "save_rubrics",
     "search_apollo",
+    "search_available_integrations",
     "search_engagement_posts",
     "search_harvest_jobs",
     "search_inbox_threads",
@@ -164,6 +162,7 @@ export const SELLABLE_MCP_TOOL_NAMES = [
     "start_campaign_message_preparation",
     "start_cli_login",
     "start_direct_campaign",
+    "start_integration_connection",
     "start_on_demand_campaign",
     "update_campaign",
     "update_campaign_brief",
@@ -185,3 +184,42 @@ export const SELLABLE_MCP_TOOL_NAMES = [
     "wait_for_lead_list_ready",
     "wait_for_rubric_results",
 ];
+/**
+ * Explicit mutation classification lives beside (but outside) the flat tool
+ * registry. Neither this list nor `isMutatingTool` is an input to
+ * `compileAgentToolPolicy`, so editing it cannot move the fleet-pinned
+ * `policyHash`.
+ */
+export const MUTATING_TOOL_NAMES = [
+    "pause_campaign",
+    "archive_campaign",
+    "update_campaign",
+    "fill_campaign_horizon",
+    "set_campaign_waterfall_order",
+    "set_sender_routing",
+    "send_inbox_draft",
+    "send_inbox_manual_reply",
+    "load_csv_dnc_entries",
+    "update_cell",
+    "queue_cells",
+];
+const MUTATING_TOOL_NAME_SET = new Set(MUTATING_TOOL_NAMES);
+export function isMutatingTool(name) {
+    return MUTATING_TOOL_NAME_SET.has(name);
+}
+export const CROSS_WORKSPACE_EXPLICIT_WORKSPACE_REQUIRED = {
+    code: "cross_workspace_explicit_workspace_required",
+    message: "Cross-workspace mutations require an explicit non-empty workspaceId. Name the target workspace and retry.",
+};
+export function crossWorkspaceMutationRefusal(input) {
+    const workspaceId = input.args && typeof input.args === "object"
+        ? input.args.workspaceId
+        : undefined;
+    const explicitWorkspaceNamed = typeof workspaceId === "string" && workspaceId.trim().length > 0;
+    return input.scope === "CROSS_WORKSPACE" &&
+        input.workspaceBinding !== "" &&
+        isMutatingTool(input.toolName) &&
+        !explicitWorkspaceNamed
+        ? CROSS_WORKSPACE_EXPLICIT_WORKSPACE_REQUIRED
+        : null;
+}

package/dist/api.d.ts

@@ -35,6 +35,8 @@ export declare class SellableApiError extends Error {
     constructor(status: number, body: string, guidance?: string);
 }
 export declare class SellableApi {
+    private readonly explicitWorkspaceContext;
+    withWorkspaceId<T>(workspaceId: string | null | undefined, callback: () => Promise<T>): Promise<T>;
     private buildError;
     private requestResponse;
     private request;

package/dist/api.js

@@ -3,7 +3,9 @@ import { mkdir, rename, rm, stat } from "node:fs/promises";
 import path from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { getConfig, getConfigPath, getEffectiveConfiguredWorkspaceId, resolveWorkspaceIdForRequest, } from "./auth.js";
+import { recordAgentScope } from "./agent-scope.js";
 export class SellableApiError extends Error {
     status;
     body;
@@ -19,6 +21,13 @@ export class SellableApiError extends Error {
     }
 }
 export class SellableApi {
+    explicitWorkspaceContext = new AsyncLocalStorage();
+    async withWorkspaceId(workspaceId, callback) {
+        const normalized = typeof workspaceId === "string" && workspaceId.trim()
+            ? workspaceId.trim()
+            : null;
+        return this.explicitWorkspaceContext.run(normalized, callback);
+    }
     buildError(status, errorText) {
         const isAuthError = status === 401 || status === 403;
         const isWorkspaceMembershipError = status === 403 && errorText.includes("No access to workspace");
@@ -42,10 +51,16 @@ export class SellableApi {
         // Re-read config on every request so workspace switches take effect immediately
         const config = getConfig();
         const url = `${config.apiUrl}${path}`;
+        const contextualWorkspaceId = this.explicitWorkspaceContext.getStore();
+        const hasExplicitWorkspace = (options &&
+            Object.prototype.hasOwnProperty.call(options, "workspaceId")) ||
+            contextualWorkspaceId !== undefined;
         const requestedWorkspaceId = options && Object.prototype.hasOwnProperty.call(options, "workspaceId")
             ? options.workspaceId
-            : getEffectiveConfiguredWorkspaceId(config);
-        const workspaceId = options && Object.prototype.hasOwnProperty.call(options, "workspaceId")
+            : contextualWorkspaceId !== undefined
+                ? contextualWorkspaceId
+                : getEffectiveConfiguredWorkspaceId(config);
+        const workspaceId = hasExplicitWorkspace
             ? resolveWorkspaceIdForRequest(requestedWorkspaceId, `${method} ${path}`)
             : requestedWorkspaceId;
         // Opt-in only: no `signal` is attached unless the caller asked for a bound,
@@ -93,7 +108,13 @@ export class SellableApi {
     }
     async request(method, path, body, options) {
         const response = await this.requestResponse(method, path, body, options);
-        return response.json();
+        const parsed = (await response.json());
+        if (parsed &&
+            typeof parsed === "object" &&
+            Object.prototype.hasOwnProperty.call(parsed, "agentScope")) {
+            recordAgentScope(parsed.agentScope);
+        }
+        return parsed;
     }
     async get(path, options) {
         return this.request("GET", path, undefined, options);

package/dist/auth.js

@@ -3,6 +3,7 @@ import { createHash } from "node:crypto";
 import * as os from "os";
 import * as path from "path";
 import { readMcpAgentServiceContext } from "./agent-service-auth.js";
+import { getAgentScope } from "./agent-scope.js";
 export const DEFAULT_API_URL = "https://app.sellable.dev";
 const WORKSPACE_LOCK_ENV = "SELLABLE_LOCK_WORKSPACE_ID";
 const REQUIRE_WORKSPACE_LOCK_ENV = "SELLABLE_REQUIRE_WORKSPACE_LOCK";
@@ -177,6 +178,11 @@ function normalizeWorkspaceId(value) {
 }
 export function getEffectiveConfiguredWorkspaceId(config) {
     assertWorkspaceLockSatisfied("workspace resolution");
+    if (getAgentScope() === "CROSS_WORKSPACE") {
+        return (normalizeWorkspaceId(config.activeWorkspaceId) ||
+            normalizeWorkspaceId(config.workspaceId) ||
+            getLockedWorkspaceId());
+    }
     return (getLockedWorkspaceId() ||
         normalizeWorkspaceId(config.activeWorkspaceId) ||
         normalizeWorkspaceId(config.workspaceId));
@@ -187,6 +193,9 @@ export function resolveWorkspaceIdForRequest(requestedWorkspaceId, action = "Sel
     const requested = normalizeWorkspaceId(requestedWorkspaceId);
     if (!lockedWorkspaceId)
         return requested;
+    if (getAgentScope() === "CROSS_WORKSPACE") {
+        return requested || lockedWorkspaceId;
+    }
     if (requested && requested !== lockedWorkspaceId) {
         throw new Error(`Workspace lock violation: ${action} requested workspace ${requested}, but this profile is locked to ${lockedWorkspaceId}.`);
     }
@@ -248,12 +257,20 @@ export function getConfig() {
             const agent = readMcpAgentServiceContext(process.env, config.token);
             if (!agent)
                 throw new Error("Invalid Agent service context");
-            const configuredWorkspace = normalizeWorkspaceId(config.activeWorkspaceId) ||
-                normalizeWorkspaceId(config.workspaceId);
-            if (configuredWorkspace && configuredWorkspace !== agent.workspaceId) {
-                throw new Error("Agent service credential workspace binding mismatch");
+            const configuredActiveWorkspace = normalizeWorkspaceId(selectedRaw.activeWorkspaceId);
+            const configuredWorkspace = normalizeWorkspaceId(selectedRaw.workspaceId);
+            if (getAgentScope() === "CROSS_WORKSPACE") {
+                config.activeWorkspaceId =
+                    configuredActiveWorkspace || agent.workspaceId;
+            }
+            else {
+                const configuredIdentity = configuredActiveWorkspace || configuredWorkspace;
+                if (configuredIdentity &&
+                    configuredIdentity !== agent.workspaceId) {
+                    throw new Error("Agent service credential workspace binding mismatch");
+                }
+                config.activeWorkspaceId = agent.workspaceId;
             }
-            config.activeWorkspaceId = agent.workspaceId;
             config.workspaceId = agent.workspaceId;
             config.credentialKind = "agent_service";
         }
@@ -298,7 +315,8 @@ export function getConfiguredCredentialIntent() {
     }
 }
 export function updateActiveWorkspace(params) {
-    if (getConfig().credentialKind === "agent_service") {
+    if (getConfig().credentialKind === "agent_service" &&
+        getAgentScope() !== "CROSS_WORKSPACE") {
         throw new Error("Agent service profiles cannot switch workspaces");
     }
     resolveWorkspaceIdForRequest(params.workspaceId, "set_active_workspace");

package/dist/refill-run-loop.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { SellableApiError } from "./api.js";
 import { decodeRefillReadinessAuthority, refillReadinessExpectationInput, refillReadinessFingerprint, } from "./refill-readiness.js";
 import { normalizeMessageTemplateRevision, normalizeRefillRunHandle, normalizeRefillTargetConfig, } from "./tools/campaign-processing.js";
-import { buildRunStateFromLocalHints } from "./tools/evergreen-refill-plan.js";
+import { buildRunStateFromLocalHints } from "./tools/refill-execution-plan.js";
 import { classifyPaidInmailRefreshReceipt, prepareRowSelectorValue as defaultPrepareRowSelectorValue, refillPrepareRequestHash as defaultRefillPrepareRequestHash, validateAgentSuppliedBroadenKeywords, } from "./tools/refill-executors.js";
 import { sanitizeRefillReportingContextProjection, sanitizeRefillReportingProjection, } from "./tools/refill-target-plan.js";
 /**
@@ -699,7 +699,7 @@ function isSelectedSenderOwnedPostEngagersLane(plan, action) {
         stringValue(actionToolInput(action).campaignName) ??
         stringValue(targetCampaign?.campaignName) ??
         stringValue(targetCampaign?.name);
-    // Exact v2 packets retain target.campaigns identity even when a plain
+    // Exact refill packets retain target.campaigns identity even when a plain
     // active-campaign route omits the optional evergreen lane projection.
     // Prefer that authority so a resumed g3 checkpoint never falls through to
     // the generic agent-keyword gate for a sender-owned Post Engagers campaign.
@@ -893,6 +893,39 @@ function runScopedSignalDiscoveryAttemptUpdate(action, runState, now) {
         ],
     };
 }
+function runScopedSignalSourceValidationUpdate(action, runState, now) {
+    const toolInput = actionToolInput(action);
+    const provider = stringValue(toolInput.leadSourceProvider);
+    if (provider !== "signal-discovery" && provider !== "campaign-tracked-post") {
+        return {};
+    }
+    const campaignId = actionCampaignId(action);
+    const payload = resultPayload(runState.lastOutcome);
+    const reviewBatch = recordValue(payload.reviewBatch);
+    const reviewBatchBasisHash = stringValue(reviewBatch?.basisHash);
+    const reviewBatchRowCount = numberValue(reviewBatch?.rowCount);
+    if (!campaignId || !reviewBatchBasisHash || !reviewBatchRowCount)
+        return {};
+    const attempts = arrayValue(runState.signalSourceValidationAttempts).filter(isRecord);
+    return {
+        signalSourceValidationAttempts: [
+            ...attempts.filter((attempt) => stringValue(attempt.campaignId) !== campaignId),
+            {
+                campaignId,
+                tableId: actionTableId(action),
+                senderId: actionSenderId(action),
+                sourceLeadListId: stringValue(toolInput.sourceLeadListId),
+                sourceFingerprint: actionSourceFingerprint(action),
+                reviewBatchBasisHash,
+                reviewBatchRowCount,
+                threshold: 0.1,
+                status: "pending",
+                copiedAt: now.toISOString(),
+                scope: "refill_run",
+            },
+        ],
+    };
+}
 // Phase 110-05: Sales Nav / Prospeo same-source continuation gets exactly one
 // bounded add per (campaign, sender) per run, mirroring the Signal Discovery
 // run-scoped attempt bound so the loop never repeats an unchanged failed
@@ -2413,7 +2446,7 @@ async function gateBootstrap(input, deps, ctx) {
         input.reportingContext = issuedReportingContext;
     }
     const pinnedRunState = pinInitialSenderLaneChains(plan, ctx.runState);
-    // Exact fenced plans are projected by projectedV2Packet(), whose legacy
+    // Exact fenced plans are projected by projectedRefillExecutionPacket(), whose
     // bootstrap.paidCredit array is intentionally empty. The canonical refresh
     // authority is packet.target.globalActionQueue; reading the bootstrap array
     // minted `{ version: 2, receipts: [] }` on every run, which made the next
@@ -2524,7 +2557,7 @@ async function gateBootstrap(input, deps, ctx) {
         })
         : runStateWithoutCreditTrust;
     await safeJournalAppend(ctx, deps, deps.journal.renderBootstrapSection({
-        summary: "Refill v2 execution bootstrap",
+        summary: "Refill exact-run execution bootstrap",
         senderSummary: safeJson(recordValue(plan.bootstrap)?.senders ?? []),
         laneSummary: safeJson(recordValue(plan.bootstrap)?.laneOrder ?? []),
         targetSummary: safeJson(recordValue(plan.bootstrap)?.target ?? []),
@@ -4444,8 +4477,66 @@ async function gateVerify(input, deps, ctx, budgets) {
         return advanceBackToPlan(input, deps, ctx);
     }
     const actionType = stringValue(action.type);
-    const schedulerOutcome = resultPayload(ctx.runState.lastOutcome);
-    const schedulerOutcomeStatus = stringValue(schedulerOutcome.status);
+    let schedulerOutcome = resultPayload(ctx.runState.lastOutcome);
+    let schedulerOutcomeStatus = stringValue(schedulerOutcome.status);
+    // HOTFIX 2026-07-27: executeOneYoloPrimitive deliberately returns
+    // matching_scheduler_active when the exact request key is still running
+    // after its bounded dispatch-site settle. g3_verify previously ignored that
+    // status, reread the ready-buffer plan immediately, and terminalized the
+    // exact fence as loaded_awaiting_scheduler while the scheduler was still
+    // working. That released the workspace coordinator before the request's
+    // official receipt existed, so a later cron/read could show 30/30 even
+    // though the refill command itself stopped at 25/30.
+    //
+    // Keep this exact fence at g3_verify and poll through the SAME action. The
+    // executor's status preflight is request-key scoped and never redispatches a
+    // matching active request. When the per-invocation wait budget is reached,
+    // heartbeat and return the same runId/fence continuation; never convert an
+    // active request into loaded_awaiting_scheduler.
+    if (actionType === "run_scheduler_sweep" &&
+        schedulerOutcomeStatus === "matching_scheduler_active") {
+        for (let poll = 0; poll < budgets.maxPollsPerWait; poll += 1) {
+            const did = await deps.executors.executeOneYoloPrimitive(action, input.workspaceId);
+            schedulerOutcome = resultPayload(did);
+            schedulerOutcomeStatus = stringValue(schedulerOutcome.status);
+            await deps.runClient.recordRunOutcome({
+                workspaceId: input.workspaceId,
+                ...exactRunTarget(ctx),
+                runId: ctx.runId,
+                fence: ctx.fence,
+                eventId: lastEventId(ctx),
+                did,
+                outcome: did,
+            });
+            ctx.runState = mergeRunState(ctx.runState, {
+                lastOutcome: did,
+                progress: mergeProgress(ctx, {
+                    schedulerRequestLastCheckedAt: (deps.now?.() ?? new Date()).toISOString(),
+                    schedulerRequestStatus: schedulerOutcomeStatus ?? "scheduler_status_unreadable",
+                }),
+            });
+            if (schedulerOutcomeStatus !== "matching_scheduler_active")
+                break;
+            const waitResult = await sleepForWait(input, deps, ctx, budgets);
+            if (waitResult) {
+                if (waitResult.status !== "in_progress")
+                    return waitResult;
+                return {
+                    ...waitResult,
+                    guidance: "The exact workspace scheduler request is still running. Re-invoke this same runId/fence; verification will poll the same request key until its official terminal receipt, without redispatching it.",
+                };
+            }
+        }
+        if (schedulerOutcomeStatus === "matching_scheduler_active") {
+            const continuation = await heartbeatAndContinue(input, deps, ctx);
+            if (continuation.status !== "in_progress")
+                return continuation;
+            return {
+                ...continuation,
+                guidance: "The exact workspace scheduler request is still running. Re-invoke this same runId/fence; verification will poll the same request key until its official terminal receipt, without redispatching it.",
+            };
+        }
+    }
     if (actionType === "run_scheduler_sweep" &&
         (schedulerOutcomeStatus === "uncertain_outcome" ||
             schedulerOutcomeStatus === "scheduler_receipt_incomplete")) {
@@ -4469,6 +4560,57 @@ async function gateVerify(input, deps, ctx, budgets) {
             guidance: "The exact scheduler request has no authoritative terminal receipt. The request key was not redispatched; use a fresh planner-issued action key after scheduler reconciliation.",
         });
     }
+    const terminalSchedulerReceipt = actionType === "run_scheduler_sweep"
+        ? schedulerStatusTerminalReceipt(schedulerOutcome)
+        : null;
+    if (actionType === "run_scheduler_sweep" && terminalSchedulerReceipt) {
+        // The scheduler request is now officially done. Only this post-receipt
+        // authoritative reread may decide whether the refill target completed.
+        // A still-loaded plan is not success: surface a concrete retryable blocker
+        // with the terminal receipt instead of claiming loaded while leaving the
+        // operator unable to distinguish a scheduler miss from an active run.
+        const fresh = await deps.readPlan(refillPlanReadInput(input, { ctx, journal: false }));
+        ctx.plan = fresh;
+        const rawDoneReason = doneReasonFromPlan(fresh);
+        const normalizedDoneReason = rawDoneReason
+            ? normalizeDoneReason(rawDoneReason)
+            : null;
+        if (canonicalReportingCoverageComplete(fresh) ||
+            normalizedDoneReason === "complete" ||
+            normalizedDoneReason === "capped_by_scheduler") {
+            return completeTerminal(input, deps, ctx, normalizedDoneReason ?? "complete", {
+                plan: fresh,
+                schedulerRunReceipt: terminalSchedulerReceipt,
+            });
+        }
+        const freshHead = firstAction(fresh);
+        if (normalizedDoneReason === "loaded_awaiting_scheduler" ||
+            stringValue(freshHead?.type) === "wait_for_scheduler") {
+            return completeTerminal(input, deps, ctx, "blocked", {
+                blocker: "scheduler_terminal_with_remaining_gap",
+                retryable: true,
+                plan: fresh,
+                schedulerRunReceipt: terminalSchedulerReceipt,
+                requestKey: stringValue(actionToolInput(action).requestKey),
+                actionKey: stringValue(action.actionKey),
+                targetDate: stringValue(actionToolInput(action).targetDate) ?? input.targetDate,
+                coverage: coverageSnapshot(fresh),
+                guidance: "The exact workspace scheduler request produced an official terminal receipt, but the post-receipt target plan still has a projected gap. Do not report loaded_awaiting_scheduler; retry only from a fresh planner-issued scheduler action after the receipt's named capacity, window, cooldown, or eligibility condition changes.",
+            });
+        }
+        if (rawDoneReason) {
+            return completeTerminal(input, deps, ctx, rawDoneReason, {
+                plan: fresh,
+                schedulerRunReceipt: terminalSchedulerReceipt,
+            });
+        }
+        return advanceBackToPlan(input, deps, ctx, {
+            lastOutcome: ctx.runState.lastOutcome,
+            progress: mergeProgress(ctx, {
+                schedulerTerminalReceiptObservedAt: (deps.now?.() ?? new Date()).toISOString(),
+            }),
+        });
+    }
     if (!ctx.plan &&
         typeof actionType === "string" &&
         BROADEN_SIGNAL_SEARCH_TYPES.has(actionType)) {
@@ -4513,6 +4655,14 @@ async function gateVerify(input, deps, ctx, budgets) {
     // keep going — instead of terminalizing the invite lane with confirmed-fillable
     // slots still open. Once a broadening round proves the universe dry this run, this
     // no longer intercepts and the refusal terminalizes typed below.
+    if (actionType === "copy_selected_source_rows" &&
+        stringValue(recordValue(ctx.runState.lastOutcome)?.status) ===
+            "executed_and_reread") {
+        return advanceBackToPlan(input, deps, ctx, {
+            ...runScopedSignalSourceValidationUpdate(action, ctx.runState, deps.now?.() ?? new Date()),
+            ...clearRunScopedDrySourcePrepAttempts(actionCampaignId(action), ctx.runState),
+        });
+    }
     if (actionType === "continue_signal_discovery_source" &&
         isSignalSelectionBroadenableRefusal(ctx.runState.lastOutcome) &&
         !hasRunScopedSignalUniverseExhausted(action, ctx.runState)) {